lock root shell

[Mikkey]

I need to lock the root shell to stop access to local harddisks. I know, that all passwords are disabled by default.
Can I enable them, especially the root password, when remastering knoppix?
passwd doesnt help because it creates a password for root, but doesnt lock su or the root shell.

Please help me.

Mikkey

uuups, I forgot. The remastered knoppix with passwords enabled should run from cd.

[Steve F]

I'm guessing here but I would chroot to the uncompressed knoppix, set a root password and also remove sudoers file or edit it. Then remaster; the new burned CD should then not allow su, login as root or sudo unless you know the root password so make it long and difficult. I don't know if there is anything during startup where user knoppix needs su permissions so I think that should work.

[mzilikazi]

Try removing sudo from your remaster. kdesu and gksu both insist on having passwords.

[Mikkey]

Thanks a lot. I try it and tell you.

Mikkey

[Mikkey]

Sorry, it doesnt work, because kde doesnt start anymore.
Any suggestions how to lock the root shell and to enable a root password?

Mikkey

[Mikkey]

Juppiii
it works. Thanks a lot, mzilikazi and Steve F.
First I chroot to the uncompressed knoppix and set a password for root.
Then I removed only sudo from the uncompressed knoppix and remastered it. KDE starts, the root shell is locked, the applications I tested are working.
Only a usb memory stick isnt recogniced any more but that doesnt matter.

Mikkey

[Mikkey]

Aaaargh.
Three root shells / terminals are still open if you press Ctrl-Alt-F2 to F4 in kde.

Any suggestions how to lock them?

Mikkey

[Steve F]

Ya, that should be an easy fix. Those shells are started up from /etc/inittab . My knoppix CD inittab has lines like these:

1:12345:respawn:/bin/bash -login >/dev/tty1 2>&1 </dev/tty1
2:2345:respawn:/bin/bash -login >/dev/tty2 2>&1 </dev/tty2
3:2345:respawn:/bin/bash -login >/dev/tty3 2>&1 </dev/tty3
4:2345:respawn:/bin/bash -login >/dev/tty4 2>&1 </dev/tty4

The HD install inittab is like this:

1:12345:respawn:/sbin/getty 38400 tty1
2:2345:respawn:/sbin/getty 38400 tty2
3:2345:respawn:/sbin/getty 38400 tty3
4:2345:respawn:/sbin/getty 38400 tty4
5:2345:respawn:/sbin/getty 38400 tty5
6:2345:respawn:/sbin/getty 38400 tty6

You can comment most of them out with '#' at the beginning of the line or remove them completly. I would leave the first one in (HD version) case you need to login. Since it is getty, your user could only do things within the premission set of their login.

[Mikkey]

Thank you, Steve F.

I tried it and it worked.
Great.

Mikkey